Splunk Search

Pareto charting of sensor data

Path Finder

hey everyone,
I'm working with a lot of sensor data and i have been trying to develop a pareto chart to look at the problem children if you will, so our maintenence team can know what devices to focus on. for those of you unfamiliar with Pareto's Principle, it basically states that 80% of your problems stem from 20% of your causes.

what I want is a scatter plot where the points are the device name, the y-axis is the percentage of total alarms, and the x-axis is the percentage of total devices. but I'm not entirely sure how to get there, here is what I have. thanks for the help.

class=incident subclass=problem incident_problem_type=alarm | eventstats count by unique_unit_name | stats count(unique_unit_name) as count_of_units | eval sum(count) as total
0 Karma


I would consider using timechart to create a pie chart of the number of incidents. Also, I've never used NOT to ignore a value, but instead I would use:

incident_problem_type=alarm incident_problem_type!=camera
0 Karma

Path Finder

you can ignore the not camera statement, i use it only so i can see the data i'm evaluating, its not a problem type, but exists inside the alarm problem set.

also this doesn't answer my question, i can do a pie chart of incidents very easily, but its not what i want in the sense of development.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...